An AI SDR is a system rather than a single tool. It chains together a data source, enrichment, verification, sequencing, reply handling and a CRM, and a human takes over once a prospect engages. For a team of under 50 people, the parts that decide results are usually not the AI model. They are email deliverability under the Google and Yahoo bulk-sender rules in force since February 2024, a lawful basis for outreach, and a clean handoff to a person.
Key takeaways
- •Sales reps spend about 28% of their week selling, according to Salesforce's State of Sales survey of more than 7,700 sales professionals. Prospecting admin is a large part of the rest.
- •73% of B2B buyers actively avoid suppliers who send irrelevant outreach (Gartner, 2025). Automated volume without relevance does harm.
- •Since 1 February 2024, Google requires senders of more than 5,000 messages a day to Gmail to use SPF, DKIM and DMARC, offer one-click unsubscribe and keep spam rates below 0.3%.
- •CAN-SPAM applies to business-to-business email, with penalties of up to $53,088 per non-compliant email.
- •Under GDPR, serious breaches can lead to fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.
Where SDRs actually find their leads
Before looking at AI, it helps to be clear about where prospect data comes from. Human SDRs and AI SDR tools draw on the same sources. The difference is how quickly and consistently they are combined.
| Source | What it gives you | Strength | Limitation |
|---|---|---|---|
| B2B contact databases | Names, titles, company firmographics, work emails, phone numbers | Fast to filter by industry, size, role | Data decays; contacts change jobs |
| Company registries and filings | Legal entity, directors, incorporation date, filing history | Authoritative, free or low cost | Few contact details |
| Hiring signals (job posts) | Teams growing, new tools being adopted, new leaders arriving | Strong timing signal | Needs interpretation |
| Technographic data | Software a company runs on its website or stack | Good for integration-led products | Partial coverage |
| Website visitor identification | Companies visiting your pages | Shows active interest | Company-level only in many regions; privacy limits |
| Intent data providers | Topic research spikes across publisher networks | Early signal | Probabilistic; vendor-dependent |
| Local business listings and maps | SMB names, categories, phone numbers, reviews | Good for local-services targeting | Owner contacts often missing |
| LinkedIn and professional networks | Role history, posts, mutual connections | Context for personalisation | Platform terms restrict scraping and automation |
| Inbound and events | Form fills, webinar attendees, booth scans | Consent and intent already present | Limited volume |
Most small teams combine two or three of these. A dedicated lead-search tool such as ProLeads is one option for building filtered lists. Many teams also pull from their CRM's own history of closed-lost deals and past customers, which is often an under-used source.
How AI SDR tools actually find and work leads
Strip away the marketing language and an AI SDR system has six components. Off-the-shelf "AI SDR" products bundle several of them. Custom builds connect best-of-breed parts with an orchestration layer.
| Component | Job | Common failure mode |
|---|---|---|
| 1. Data | Pull accounts and contacts that match your ideal customer profile | Profile too broad; list is large but irrelevant |
| 2. Enrichment | Add firmographics, tech stack, recent news, hiring, role context | Enriching everyone wastes credits; stale fields |
| 3. Verification | Check that emails exist and phone numbers are valid | Skipped to save cost, which causes bounces and domain damage |
| 4. Sequencing and personalisation | Write and schedule multi-step outreach | Generic AI copy; too many steps; wrong cadence |
| 5. Reply handling | Classify replies, answer simple questions, book meetings, handle opt-outs | Misclassified objections; opt-outs not honoured |
| 6. CRM | Record every touch, outcome and consent state | Data lives in the outreach tool, not the CRM |
1. Data: start narrower than feels comfortable
AI makes it cheap to reach more people, which tempts teams to widen the target. Do the opposite. Define the ideal customer profile with firm criteria (industry, headcount band, region, a trigger event) and exclusions (current customers, open deals, competitors, suppressed contacts). A list of 400 well-matched accounts usually teaches you more than one of 10,000 loose matches.
2. Enrichment: answer "why now?"
Enrichment is where AI helps most. A language model can read a company's website, recent announcements and job posts, then summarise in two sentences why this account might care now. The output should be a hypothesis for the rep or sequence to test, not a fact to state in an email. Keep enrichment to the fields that change the message. Each field you collect is also personal or company data you have to justify holding.
3. Verification: the step people skip
Sending to invalid addresses raises bounce rates, and bounces and complaints damage domain reputation. Verify every email before it enters a sequence. Re-verify contacts that have sat unused for more than a few weeks, because job changes are common.
4. Sequencing and personalisation
AI-written outreach works when it is grounded in the enrichment data and kept short. It fails when it imitates personalisation ("I loved your recent post!") without substance. Gartner's 2025 survey found that 73% of B2B buyers actively avoid suppliers who send irrelevant outreach. Relevance is a commercial requirement, not a nicety.
Practical rules:
- •Three to five touches across email and, where lawful, phone or LinkedIn, not twelve.
- •One clear reason for reaching out, tied to the "why now" signal.
- •A human reviews new templates and samples live output each week.
5. Reply handling
This is where an AI SDR saves real time. A classifier sorts replies into interested, not now, wrong person, objection, out of office and unsubscribe. It then:
- •Books meetings directly for interested replies.
- •Finds the right colleague when told "wrong person", and logs the referral.
- •Schedules a follow-up for "not now" with the date the prospect gave.
- •Suppresses unsubscribes at once, across every tool.
- •Sends objections and anything ambiguous to a human.
Some teams add an AI calling agent to call back inbound responders or confirm meetings. The phone-consent rules for your jurisdiction apply.
6. CRM: the system of record
If outreach data lives only in the sequencing tool, you lose the history when you switch tools and cannot measure pipeline properly. Every touch, reply class, meeting and consent change should sync to the CRM. CRM integration is often the least visible and most valuable part of an AI SDR build.
Deliverability: the rules changed in 2024
Cold email depends on reaching the inbox. In February 2024 Google and Yahoo introduced formal requirements for bulk senders that turned long-standing good practice into rules.
| Requirement | Google, all senders | Google, more than 5,000 messages/day | Yahoo |
|---|---|---|---|
| SPF or DKIM authentication | Required (SPF or DKIM) | Required (SPF and DKIM) | Required |
| DMARC record | Not required | Required (policy can be p=none) | Strongly urged for every sending domain |
| DMARC alignment of From: domain | — | Required | Expected |
| Valid forward and reverse DNS | Required | Required | Required |
| TLS for transmission | Required | Required | — |
| Spam rate | Below 0.3% | Below 0.3% | Below 0.3% |
| One-click unsubscribe | — | Required for marketing and subscribed messages | Required (list-unsubscribe header) |
Source: Google Email sender guidelines and Yahoo Sender Hub best practices.
What SPF, DKIM and DMARC do
- •SPF lists the servers allowed to send mail for your domain.
- •DKIM adds a cryptographic signature that proves the message was not altered and came from your domain.
- •DMARC tells receiving servers what to do when SPF or DKIM fails, and sends you reports on who is sending as you.
Google's Postmaster guidance recommends aiming for a spam rate below 0.10% and never reaching 0.30%. For outreach, that means low daily volume per mailbox, separate sending domains so your main domain is protected, gradual warm-up, and stopping a campaign as soon as complaint signals rise.
Small teams often fall below the 5,000-a-day threshold. Following the stricter tier anyway costs little and protects you as you grow. Google also treats a sender that crosses the threshold once as a bulk sender from then on.
Compliance: GDPR, PECR and CAN-SPAM
The rules depend on where your recipients are, not where you are.
| Jurisdiction | Rule | What it means for B2B outreach |
|---|---|---|
| United States | CAN-SPAM Act | No B2B exemption. Accurate headers, non-deceptive subject lines, identify the message as an ad, include a valid postal address, honour opt-outs within 10 business days. Up to $53,088 per violating email |
| United Kingdom | PECR plus UK GDPR | Corporate bodies can be emailed without prior consent. Sole traders and some partnerships are treated as individuals. UK GDPR still applies to employees' personal data |
| European Union | GDPR plus national ePrivacy laws | A lawful basis is needed (often legitimate interests, with a documented assessment); transparency about the data source; absolute right to object to direct marketing. National rules on B2B email differ |
Practical controls that cover most of this:
- •One suppression list shared by every tool, checked before every send.
- •A record of data source for each contact, so you can tell people where you got their details.
- •A short privacy notice link in each first-touch email.
- •Documented legitimate interests assessments for EU and UK outreach.
- •Retention rules that delete unresponsive prospect data after a set period.
This is general information, not legal advice. Check your own position with counsel, especially if you contact sole traders, consumers or regulated sectors.
Build vs buy for teams under 50
There is no single "best AI SDR tool for startups". There is a fit between your volume, your stack and how much control you need.
| Approach | Suits | Advantages | Trade-offs |
|---|---|---|---|
| All-in-one AI SDR platform | Teams wanting a quick start with modest customisation | One contract; data, sequencing and AI writing bundled | Data quality varies by region; limited control over logic; another place where data lives |
| Assembled stack (data + verification + sequencer + CRM, connected with automation) | Teams with a clear process and someone to own operations | Choose each part on merit; swap parts later | Needs integration work and monitoring |
| Custom-built agent workflow | Teams with unusual targeting, compliance needs or existing systems | Logic, prompts, guardrails and data flows fit your process | Upfront build; needs maintenance |
Questions worth asking any vendor or builder:
- •Where does contact data come from, and how is it kept up to date in your target regions?
- •Is every email verified before sending?
- •Can AI-written messages be reviewed before they go out, and how is tone controlled?
- •How are replies classified, and what happens to unclear ones?
- •Does every touch and consent change sync to your CRM?
- •How are unsubscribes applied across all tools?
Aiwalay's AI automation work mostly falls in the second and third rows: connecting the tools a team already pays for and adding AI steps where they save time.
The human handoff
Gartner's 2025 research found that 61% of B2B buyers prefer an overall rep-free buying experience. The same research found buyers still want seller input when judging whether a product fits their company's needs. That is the case for a clear handoff: automation handles research and first contact, and a person handles judgement.
| Trigger | Handoff action | Context passed to the human |
|---|---|---|
| Positive reply or meeting booked | Assign to account executive; confirm meeting | Enrichment summary, full thread, "why now" signal |
| Pricing or technical question | Human replies, ideally the same working day | Question, account size, current stack |
| Objection or complaint | Human reviews; sequence paused | Thread and reply classification |
| Referral to a colleague | Human approves the new contact before outreach | Referrer's name and wording |
| High-value account engages | Senior rep takes over | Account history from CRM |
Set a response target for each trigger and report on it. The speed that matters for inbound leads matters just as much once a cold prospect replies.
A practical starting sequence
- •Write the ideal customer profile and exclusion rules on one page.
- •Set up SPF, DKIM and DMARC on separate sending domains and warm them up.
- •Build a verified list of a few hundred accounts.
- •Run a short sequence with human review of AI drafts.
- •Turn on reply classification and CRM sync.
- •Measure meetings per hundred contacts, and use the ROI calculator to judge cost per meeting against deal value.
If reporting is the gap, a data analytics layer on top of the CRM shows which signals and messages produce pipeline.
Further reading: our article on calculating lead generation ROI covers how to value the meetings an AI SDR system books, and the custom CRM development page explains how outreach data can be kept in one record.
Sources
- •Salesforce, State of Sales research, published December 2022 (survey of 7,775 sales professionals)
- •Gartner, "Gartner Sales Survey Finds 61% of B2B Buyers Prefer a Rep-Free Buying Experience", June 2025
- •Google Workspace Admin Help, Email sender guidelines
- •Yahoo Sender Hub, Sender best practices
- •US Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business
- •UK Information Commissioner's Office, Electronic mail marketing under PECR
- •GDPR, Article 83: General conditions for imposing administrative fines